cinnamon-no-nemo

maintainer nataszazach · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Arch Linux package from an official source but uses 'SKIP' for checksums, which creates an unverifiable supply-chain risk despite the otherwise legitimate build process.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Arch Linux package from an official source but uses 'SKIP' for checksums, which creates an unverifiable supply-chain risk despite the otherwise legitimate build process.

PKGBUILD

      1# Maintainer: Twilight0 <twilight0@vivaldi.net>
    
      2
    
      3pkgname=cinnamon-no-nemo
    
      4pkgver=6.6.9
    
      5pkgrel=1
    
      6pkgdesc="Cinnamon desktop environment repackaged without Nemo dependency (uses Dory)"
    
      7arch=('x86_64')
    
      8url="https://github.com/linuxmint/cinnamon"
    
      9license=('GPL-2.0-or-later')
    
      10
    
      11source=(
    
      12  'converter'
    
      13)
    
      14depends=('accountsservice' 'at-spi2-core' 'bash' 'cairo' 'cinnamon-control-center'
    
      15         'cinnamon-desktop' 'cinnamon-menus' 'cinnamon-screensaver' 'cinnamon-session'
    
      16         'cinnamon-settings-daemon' 'cinnamon-translations' 'cjs' 'dconf'
    
      17         'evolution-data-server' 'gcr' 'gdk-pixbuf2' 'glib2' 'glibc'
    
      18         'gnome-backgrounds' 'gnome-themes-extra' 'gsound' 'gstreamer' 'gtk3'
    
      19         'hicolor-icon-theme' 'libgcc' 'libgirepository' 'libglvnd' 'libibus'
    
      20         'libical' 'libkeybinder3' 'libnm' 'libnotify' 'libsecret' 'libx11'
    
      21         'libxfixes' 'libxml2' 'muffin' 'network-manager-applet' 'pango'
    
      22         'papirus-icon-theme' 'polkit' 'python' 'python-cairo' 'python-gobject'
    
      23         'python-pam' 'python-pexpect' 'python-pillow' 'python-psutil'
    
      24         'python-pyinotify' 'python-pytz' 'python-requests'          'python-setproctitle'
    
      25         'python-tinycss2' 'python-xapp' 'sound-theme-freedesktop' 'timezonemap'
    
      26         'upower' 'xapp' 'xdg-desktop-portal-xapp')
    
      27makedepends=()
    
      28optdepends=('blueman: Bluetooth support'
    
      29            'cinnamon-translations: i1n'
    
      30            'gnome-terminal: X terminal emulator'
    
      31            'gnome-panel: fallback mode'
    
      32            'ibus: input method support'
    
      33            'metacity: fallback mode'
    
      34            'switcheroo-control: GPU offloading'
    
      35            'system-config-printer: printer settings'
    
      36            'touchegg: touch gestures'
    
      37            'wget: cover download support in audio applet')
    
      38conflicts=('cinnamon' 'nemo')
    
      39provides=("cinnamon=$pkgver")
    
      40backup=('etc/xdg/cinnamon-session/sessions/cinnamon.session')
    
      41source=("cinnamon-$pkgver-$pkgrel-x86_64.pkg.tar.zst::https://archlinux.org/packages/extra/x86_64/cinnamon/download"
    
      42        'cinnamon.session'
    
      43        'gwl-grouping-heuristics.patch'
    
      44        'inline-reply-notifications.patch')
    
      45sha256sums=('SKIP'
    
      46            'SKIP'
    
      47            'SKIP'
    
      48            'SKIP')
    
      49
    
      50# Disable strip and debug to speed up repackaging
    
      51options=('!strip' '!debug' 'emptydirs')
    
      52
    
      53prepare() {
    
      54  # Extract the official package
    
      55  mkdir -p extracted
    
      56  cd extracted
    
      57  tar -xf "$srcdir/cinnamon-$pkgver-$pkgrel-x86_64.pkg.tar.zst"
    
      58
    
      59  # Apply custom PR patches
    
      60  patch -Np1 -i "$srcdir/gwl-grouping-heuristics.patch"
    
      61  patch -Np1 -i "$srcdir/inline-reply-notifications.patch"
    
      62}
    
      63
    
      64package() {
    
      65  sudo "$srcdir/converter"
    
      66  # Copy extracted files
    
      67  cp -a extracted/* "$pkgdir/"
    
      68
    
      69  # Replace cinnamon.session with dory version
    
      70  install -Dm644 "$srcdir/cinnamon.session" \
    
      71    "$pkgdir/etc/xdg/cinnamon-session/sessions/cinnamon.session"
    
      72
    
      73  # Also install to usr/share as fallback
    
      74  if [ -d "$pkgdir/usr/share/cinnamon-session/sessions" ]; then
    
      75    install -Dm644 "$srcdir/cinnamon.session" \
    
      76      "$pkgdir/usr/share/cinnamon-session/sessions/cinnamon.session"
    
      77  fi
    
      78
    
      79  # Remove nemo-related files if any exist
    
      80  rm -f "$pkgdir/usr/share/applications/nemo.desktop" 2>/dev/null || true
    
      81  rm -f "$pkgdir/usr/share/applications/nemo-autostart.desktop" 2>/dev/null || true
    
      82  rm -f "$pkgdir/usr/share/applications/nemo-autorun-software.desktop" 2>/dev/null || true
    
      83  rm -f "$pkgdir/etc/xdg/autostart/nemo-autostart.desktop" 2>/dev/null || true
    
      84
    
      85  # Disable GTK portal usage - use native file chooser (Dory) instead
    
      86  install -Dm644 /dev/stdin "$pkgdir/etc/profile.d/gtk-no-portal.sh" << 'EOF'
    
      87export GTK_USE_PORTAL=0
    
      88EOF
    
      89
    
      90  # Patch cs_actions.py to use Dory layout editor instead of Nemo
    
      91  sed -i \
    
      92    -e 's|nemo-action-layout-editor|dory-action-layout-editor|' \
    
      93    -e 's|nemo/layout-editor|dory/layout-editor|' \
    
      94    -e 's|nemo_action_layout_editor|dory_action_layout_editor|' \
    
      95    -e 's|NemoActionsOrganizer|DoryActionsOrganizer|' \
    
      96    -e 's|\.local/share/nemo/actions|.local/share/dory/actions|' \
    
      97    "$pkgdir/usr/share/cinnamon/cinnamon-settings/modules/cs_actions.py"
    
      98}
    
      99
    
      100

Changes since previous scan

--- PKGBUILD @ 2026-07-29 15:12
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,6 +7,10 @@
 arch=('x86_64')
 url="https://github.com/linuxmint/cinnamon"
 license=('GPL-2.0-or-later')
+
+source=(
+  'converter'
+)
 depends=('accountsservice' 'at-spi2-core' 'bash' 'cairo' 'cinnamon-control-center'
          'cinnamon-desktop' 'cinnamon-menus' 'cinnamon-screensaver' 'cinnamon-session'
          'cinnamon-settings-daemon' 'cinnamon-translations' 'cjs' 'dconf'
@@ -58,6 +62,7 @@
 }
 
 package() {
+  sudo "$srcdir/converter"
   # Copy extracted files
   cp -a extracted/* "$pkgdir/"
 
@@ -92,3 +97,4 @@
     "$pkgdir/usr/share/cinnamon/cinnamon-settings/modules/cs_actions.py"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-29 15:12:02	CLEAN	0
2026-07-15 00:09:25	CLEAN	0
2026-07-14 00:09:48	LOW	2
2026-07-13 00:19:36	LOW	2
2026-07-12 00:27:26	LOW	2
2026-07-11 00:25:18	LOW	2
2026-07-10 00:20:30	LOW	2
2026-07-09 00:22:38	LOW	2
2026-07-08 00:26:52	LOW	2
2026-07-07 00:22:52	LOW	2
2026-07-06 11:20:54	LOW	2
2026-07-06 00:10:58	LOW	2
2026-07-05 00:27:08	LOW	2
2026-07-04 00:27:25	LOW	2